mirror of
https://github.com/hakril/PythonForWindows
synced 2026-06-08 14:31:45 +00:00
hakril
23 lines
772 B
Python
23 lines
772 B
Python
import argparse
|
|
import windows
|
|
|
|
def read_apisetmap():
|
|
cp = windows.current_process
|
|
apisetmap_addr = cp.peb.ApiSetMap
|
|
print("ApiSetMap address <{0:#x}>".format(apisetmap_addr))
|
|
apisetmap_version = cp.read_dword(apisetmap_addr)
|
|
print("ApiSetMap version <{0}>".format(apisetmap_version))
|
|
meminfo = cp.query_memory(apisetmap_addr)
|
|
print(meminfo)
|
|
data = cp.read_memory(meminfo.BaseAddress, meminfo.RegionSize)
|
|
return data
|
|
|
|
|
|
|
|
parser = argparse.ArgumentParser(prog=__file__)
|
|
parser.add_argument('--filename', default="apisetmap.dmp", help='The filename in which the ApiSetMap is dumped')
|
|
res = parser.parse_args()
|
|
|
|
with open(res.filename, "wb") as f:
|
|
f.write(read_apisetmap().encode("base64"))
|
|
print("<{0}> generated".format(res.filename)) |